# NousResearch/hermes-agent · Feishu approval card auth and identity fixes

## Open now

- 8 issues, 8 PRs open on GitHub.
- #26183: \[Bug\]: Feishu DM authorization fails — \`hermes gateway setup\` writes open_id but runtime uses user_id for FEISHU_ALLOWED_USERS check
- #35032: fix(feishu): approval buttons broken after v0.15.0 upgrade when no admins configured
- #35207: \[Regression\] Feishu Approval Cards broken in v0.15
- #37252: Feishu/Lark: approval card-button clicks rejected for allow-listed users (open_id vs user_id mismatch)
- #40225: fix(feishu): card approval buttons use _allow_group_message instead of _is_interactive_operator_authorized, rejecting all users in DM
- #51583: Feishu: Approval card clicks rejected when \`FEISHU_ALLOW_ALL_USERS=true\` but \`FEISHU_GROUP_POLICY\` not set
- #51684: \[Feishu\] FEISHU_ALLOWED_USERS=* wildcard does not apply to approval card clicks
- #57202: \[Bug\]: FEISHU_ALLOWED_USERS=* wildcard broken for DM messages — dm_policy_rejected
- PR #21396: fix(feishu): prefer open_id over user_id in sender identity
- PR #26225: fix: align Feishu DM allowlist auth with setup open_id
- PR #35042: fix(feishu): use consistent auth check for approval card actions
- PR #37417: fix(feishu): authorize approval clicks via cached aliases
- PR #40271: fix(feishu): card approval buttons use _is_interactive_operator_authorized (#40225)
- PR #51778: fix(feishu): honor FEISHU_ALLOWED_USERS=* wildcard for approval card clicks
- PR #57215: fix(feishu): honor DM allowlist wildcard
- PR #57253: fix(feishu): honor wildcard allowed users

Multiple bugs and fixes around Feishu/Lark approval card button authorization, covering open_id vs user_id identity mismatches, wildcard FEISHU_ALLOWED_USERS not being honored in DMs, and incorrect auth check methods being used for interactive card actions.

## TL;DR

- 22 member(s): 8 open issue(s), 0 closed issue(s), 8 open PR(s), 0 merged PR(s), 6 PR(s) closed without merging.
- No fix has been merged to main; one or more PRs were attempted (see below).
- **Recommended:** review the prior/competing PR(s) below. A fix was attempted but not merged; your case may extend or revive that work.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_PARTIAL`): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
- Members outside that structural core may belong to a different underlying problem.
- Pairwise link density `0.08`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #26183: \[Bug\]: Feishu DM authorization fails — \`hermes gateway setup\` writes open_id but runtime uses user_id for FEISHU_ALLOWED_USERS check
- #35032: fix(feishu): approval buttons broken after v0.15.0 upgrade when no admins configured
- #35207: \[Regression\] Feishu Approval Cards broken in v0.15
- #37252: Feishu/Lark: approval card-button clicks rejected for allow-listed users (open_id vs user_id mismatch)
- #40225: fix(feishu): card approval buttons use _allow_group_message instead of _is_interactive_operator_authorized, rejecting all users in DM
- #51583: Feishu: Approval card clicks rejected when \`FEISHU_ALLOW_ALL_USERS=true\` but \`FEISHU_GROUP_POLICY\` not set
- #51684: \[Feishu\] FEISHU_ALLOWED_USERS=* wildcard does not apply to approval card clicks
- #57202: \[Bug\]: FEISHU_ALLOWED_USERS=* wildcard broken for DM messages — dm_policy_rejected

## Prior & competing PRs

- **#40330: fix(feishu): approval buttons use _is_interactive_operator_authorized (#40225)**. closed without merge · fix tier `suggested`
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - _suggested-tier fix detail withheld; re-request with `?tier=all` to include it._
- **#40756: fix(gateway): use correct auth check for approval card actions in DM**. closed without merge · fix tier `suggested`
  - maintainer direction: category `superseded_by_pr`; implication `superseded`
  - _suggested-tier fix detail withheld; re-request with `?tier=all` to include it._
- **#57227: fix(feishu): wildcard FEISHU_ALLOWED_USERS for DM admission**. closed without merge · fix tier `suggested`
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `#57215`, `#57215`, `#57215`
  - _suggested-tier fix detail withheld; re-request with `?tier=all` to include it._
- **#21396: fix(feishu): prefer open_id over user_id in sender identity**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`; refs `9bd151842`
  - files: `gateway/platforms/feishu.py`
- **#26197: fix(feishu): prefer open_id over user_id in _resolve_sender_profile**. closed without merge
  - maintainer direction: category `duplicate_of`; implication `duplicate`; refs `#21396`
- **#26225: fix: align Feishu DM allowlist auth with setup open_id**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`; refs `9bd151842`
  - files: `gateway/platforms/feishu.py`, `tests/gateway/test_feishu.py`, `tests/gateway/test_feishu_bot_admission.py`, `tests/gateway/test_feishu_bot_auth_bypass.py`
- **#29477: fix(feishu): allowlist auth checks open_id alongside user_id**. closed without merge
  - maintainer direction: category `duplicate_of`; implication `duplicate`; refs `#26225`, `#26183`, `#26225`, `#26197`, `#21396`
- **#35042: fix(feishu): use consistent auth check for approval card actions**. open
  - maintainer direction: category `duplicate_of`; implication `duplicate`; refs `#34707`, `#35032`, `#20596`, `#34707`
  - files: `gateway/platforms/feishu.py`, `tests/gateway/test_feishu_approval_buttons.py`
- **#37417: fix(feishu): authorize approval clicks via cached aliases**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`; refs `552adbe0827c32df8ed9bb19e908c26eff43add7`, `3fa15b33dd910699f18a0529f448f97eb8f02042`
  - files: `gateway/platforms/feishu.py`, `tests/gateway/test_feishu_approval_buttons.py`
- **#40271: fix(feishu): card approval buttons use _is_interactive_operator_authorized (#40225)**. open
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `#40271`, `#40225`
  - files: `plugins/platforms/feishu/adapter.py`, `tests/gateway/test_feishu_approval_buttons.py`
- **#43218: fix(feishu): use open_id as primary identity instead of user_id to prevent auth mismatch**. closed without merge
  - maintainer direction: category `silent_close`; implication `active`
- **#51778: fix(feishu): honor FEISHU_ALLOWED_USERS=* wildcard for approval card clicks**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - files: `plugins/platforms/feishu/adapter.py`, `tests/gateway/test_feishu_approval_buttons.py`
- **#57215: fix(feishu): honor DM allowlist wildcard**. open
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `#57215`, `#57202`, `#57227`, `#57215`, `#57227`, `#57215`, `#57202`, `#51684`
  - files: `plugins/platforms/feishu/adapter.py`, `tests/gateway/test_feishu_bot_admission.py`, `website/docs/reference/environment-variables.md`, `website/docs/user-guide/messaging/feishu.md`
- **#57253: fix(feishu): honor wildcard allowed users**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - files: `plugins/platforms/feishu/adapter.py`, `tests/gateway/test_feishu_bot_admission.py`

## Fix status

- No merged fix on record.
- Subsystem: `gateway`